No.

That is the honest answer, and it comes straight from Google. Google Analytics, including GA4, is not HIPAA compliant, and there is no setting, plugin, or configuration that makes it compliant on any page that touches protected health information. Google will not sign a Business Associate Agreement for the product. Without that signature, every piece of patient data that reaches Google Analytics is an impermissible disclosure under federal law.

If you run digital for a health system, you have probably heard a version of “we just turned on IP anonymization, so we’re fine.” You are not fine. The reasons are worth understanding in detail, because the question hospital marketing teams should be asking has quietly changed. It is no longer “can we make GA compliant”. It is “how do we get patient data out of a tool that was never built to hold it.”

The short answer, in Google’s own words

You do not have to take a vendor’s word for any of this. Google publishes a support page titled “HIPAA and Google Analytics“, and the language is unusually direct for a product help doc. Google states plainly that it makes no representation that Analytics meets HIPAA requirements and that it “does not offer Business Associate Agreements in connection with this service.”

Then it goes further. Google tells regulated customers they may only use Analytics on pages that are not HIPAA-covered. Authenticated pages, the kind behind a patient login, should not carry Google Analytics tags at all. Even public pages tied to specific conditions, treatments, or providers are flagged as likely covered.

Read that again. The company that owns the most popular analytics tool on earth is telling hospitals, in writing, not to use it where patients are.

Worth a clarifying note, because this trips people up constantly: Google Cloud and Google Workspace are a different story. Google will sign a BAA for those. Gmail, Drive, Cloud Storage, and the rest of the enumerated Cloud services can be used with PHI under contract. Analytics is deliberately left off that list. Same parent company, opposite answer, and the difference is not an accident. Analytics earns its keep by feeding data across Google’s advertising ecosystem, and  that cross-use is the exact thing a BAA would forbid.

Why the BAA is the whole ballgame

HIPAA compliance, in the vendor context, runs through one document. When a covered entity hands patient data to an outside company, that company becomes a business associate, and it has to sign a Business Associate Agreement before it touches the data. The BAA is the contract that commits the vendor to safeguarding the information, limiting how it gets used, reporting breaches, and answering to federal regulators.

No BAA means no lawful path. It really is that binary.

So when Google declines to sign one for Analytics, the conversation about “compliant configurations” ends before it begins. There is no amount of tag tuning that creates a contractual relationship Google has explicitly refused to enter.

What counts as PHI on a website is broader than you think

Most people picture PHI as a name, a date of birth, a diagnosis code. The web version is wider, and that is where teams get caught.

The Office for Civil Rights, which enforces HIPAA, takes the position that individually identifiable health information collected on a regulated entity’s website can be PHI even when no name is attached. An IP address. A device identifier. A persistent cookie ID. On their own, these feel anonymous. Combine any one of them with the context of the visit, and the picture changes.

Consider a real page path. A visitor lands on /services/oncology/schedule-consult, and GA4 transmits that URL alongside their IP address and a client ID. That bundle now says something about a specific person’s health. URL plus identifier equals a disclosure, and the disclosure went to a company with no BAA on file.

Site search makes it worse. When someone types “spine surgery” into your search bar and the query lands in a tracked URL, you have just shipped a health-related search term, tied to an identifier, to Google’s servers.

The guidance, the lawsuit, and what actually changed

This area got genuinely messy in the last few years, so it helps to walk the timeline.

In December 2022, OCR published a bulletin on the use of online tracking technologies by HIPAA-covered entities. It drew a line between authenticated pages, the ones behind a login where tracking clearly captures PHI, and unauthenticated public pages. The controversial part was OCR’s claim that even on a public page, an IP address combined with a visit to a health-topic page could be PHI, on the logic that the visit suggests the person might seek care.

Hospitals pushed back hard, and OCR revised the guidance in March 2024 to add nuance. The update conceded that some public-page visits are not PHI. Someone reading about a condition for a school paper, or checking visiting hours, is not disclosing health information. But OCR insisted the same visit could be PHI if the person was, say, seeking treatment for themselves. Critics pointed out the obvious problem: that test depends on the visitor’s private intent, which no analytics tool can read.

Then the courts stepped in. The American Hospital Association and several hospital plaintiffs sued HHS in the Northern District of Texas. In June 2024, Judge Mark Pittman vacated the most aggressive piece of the guidance, the theory that a bare IP address plus a visit to an unauthenticated health-topic page was automatically PHI. He held that HHS had overreached its statutory authority. HHS filed an appeal, then withdrew it that same August, and as of 2026 has not issued replacement rulemaking.

Here is the part people misread. The court vacated one specific theory. It did not gut HIPAA, and it did not bless tracking on patient-facing pages. Everything about authenticated pages still stands. Every scenario where you have more than a bare IP, a cookie ID, an ad-click identifier, a logged-in session, a submitted form, still falls squarely inside HIPAA’s scope. The ruling narrowed a fringe. It did not move the wall.

Where the financial risk actually comes from

Many executives assume the threat is a federal fine from OCR. That assumption is out of date. As of 2026, OCR has issued guidance, co-signed warning letters to roughly 130 providers, and leaned its enforcement attention toward Security Rule investigations. It has not landed a single tracking-specific civil penalty.

The money has come from somewhere else, and the numbers are not small.

Private class actions, usually filed under state wiretapping and privacy statutes, have produced the largest settlements. Mass General Brigham and Dana-Farber resolved a “cookies without consent” case for $18.4 million. Advocate Aurora Health settled pixel litigation for $12.225 million after disclosing that data on more than two and a half million people had flowed to Meta and Google. Novant Health paid $6.6 million over a Meta Pixel running on its MyChart portal. MarinHealth, the University of Rochester Medical Center, and others have settled in the millions. One analysis put total pixel-related settlements and penalties past $100 million across roughly nineteen cases between 2023 and 2025.

State attorneys general have moved on their own authority too. New York’s AG secured $300,000 from New York-Presbyterian after finding that tracking tools shared IP addresses, health-revealing URLs, and cookie identifiers with Google, Meta, and others over a six-year span, affecting more than 54,000 people.

The Federal Trade Commission has been busy with non-HIPAA digital health firms. GoodRx paid a $1.5 million penalty in the FTC’s first action under its Health Breach Notification Rule. BetterHelp paid $7.8 million for handing mental-health intake data to advertising platforms. In 2024 the FTC amended that rule to make clear a “breach” includes disclosures to ad platforms through pixels, not only hacks by outsiders.

So the picture is this. The federal HIPAA fine for trackers has not arrived yet. Almost everything else has.

Why the technical fixes do not actually fix it

Engineering teams reliably ask whether they can configure their way out. The short version is that you can reduce risk, but you cannot manufacture a BAA, and the residual exposure on patient-facing pages stays high.

IP anonymization is the most common false comfort. In GA4, the IP is used briefly for coarse geolocation and is not retained long term. That sounds reassuring until you remember the real IP still travels to Google’s servers before any of that processing happens, and the IP was only ever one identifier among several. Anonymizing it does nothing about the URL that names a condition, nothing about the persistent client ID, nothing about the device fingerprint.

Server-side tagging is the more sophisticated attempt. Route data through a self-hosted container, strip or hash identifiers, then forward a cleaned payload to Google. Done with real discipline, this genuinely cuts what Google receives. It also carries three problems. Hashes can be reversed or used to relink records, which the FTC has warned about directly. The allow-listing has to be perfect, forever, or PHI leaks through the first time someone ships a new page. And even flawless filtering does not produce the one thing you actually need, which is Google’s signature on a contract it has declined to sign.

Underneath all of it sits the structural issue. Analytics sends data to Google, for Google’s purposes, and the advertising integrations that make GA valuable are designed to pull that data into ad systems. That is the cross-context use a BAA exists to prevent.

What health systems are actually doing about it

The teams that have worked through this tend to land on some combination of three moves.

First, they scope hard. Every Google tag comes off authenticated areas and off any unauthenticated page tied to a specific condition, provider, or appointment flow. GA, if it stays at all, gets restricted to genuinely general content like careers pages and press. This is Google’s own recommendation, and it is brittle, because GA runs site-wide by default and pages drift into PHI territory the moment marketing launches a new service line.

Second, they deploy consent management so non-essential trackers fire only after a visitor opts in. Consent matters a great deal for state wiretapping exposure and for laws like Washington’s My Health My Data Act. It is not a HIPAA substitute, though. When PHI is involved, you need both the patient’s consent and the vendor’s BAA. One does not cover for the other.

Third, and increasingly this is the real answer for multi-hospital systems, they move analytics onto infrastructure that will sign a BAA. The market here has matured, and the options sort into a few shapes:

• Freshpaint sits between your site and your downstream tools, filtering PHI out before forwarding allow-listed data, and signs a BAA on its compliance plan.
• LightTrail and other healthcare-specific platforms are built to deliver marketing and traffic insight while signing a BAA and keeping patient data out of third-party advertising systems entirely.
• Piwik PRO offers enterprise analytics with a custom BAA and US hosting.
• Matomo, Plausible, and Fathom are privacy-first tools, but the route to HIPAA control with them is self-hosting on infrastructure you own, since their standard cloud plans generally do not come with a BAA.

The differences matter less than the common test. A credible HIPAA-compliant analytics choice is defined first by whether the vendor will sign a BAA covering your exact use, and second by where the data lives and whether the vendor ever uses it for its own ends. Run any tool you are evaluating through those two questions before you look at a single dashboard feature.

The bottom line

Google Analytics is a fine product. It is also, by Google’s own clear instruction, the wrong place for patient data, and no court ruling has changed that.

The 2024 decision narrowed one contested theory about IP addresses on public pages. It left the core of HIPAA untouched, kept every authenticated-page obligation in force, and did nothing to slow the class actions, the state AG actions, and the FTC enforcement that have already moved well over a hundred million dollars out of health system budgets.

For a system running two to fifteen hospitals, the defensible path is not clever configuration. It is removing third-party trackers from anywhere a patient might be, layering consent on top, and putting your analytics on a platform whose vendor will put its name on a BAA. Verify that signature in writing before anything else. Everything downstream depends on it.

***

This article is editorial analysis, not legal advice. Validate page-by-page scoping and every vendor BAA with your own privacy counsel.

Robert Haynes, a psychology graduate from the University of Hertfordshire, has a keen interest in the fields of mental health, wellness, and lifestyle.